Device having a security function

Abstract

The invention relates to a device (50) having a security function, wherein the device (50) has: - a bus interface (3) for receiving and transmitting data packets (101, 112) via a bus (10B); - a technology controller (1), which is configured to control said security function; - a communication controller (2), which is responsible for a bus connection of the device (50) and is configured to forward data packets (112) for transmission, which have been created by the technology controller (1), to the bus interface (3) and to forward data packets (101) received from the bus interface (3) to the technology controller (1); - two redundant data packet evaluation paths, which are each configured to evaluate a data packet (101) which has arrived at the bus interface (3) with regard to whether the data packet (101) contains a request of the security function, wherein a first of the data packet evaluation paths comprises the technology controller (1), which is configured to carry out an evaluation of the data packet (101) by means of a first security program (15), and wherein a second of the data packet evaluation paths comprises the communication controller (2), which is configured to carry out an evaluation of the data packet (101) by means of a second security program (75); and - a watchdog module (17), which is configured carry out logical and temporal program monitoring (14) of the first security program (15), which runs on the technology controller (1), and wherein the technology controller (1) is configured to carry out logical and temporal program monitoring of the second security program (75), which runs on the communication controller (2).

Description

[0001] 202408803

[0002] 1

[0003] Description

[0004] Device with a safety function

[0005] Technical field

[0006] The present invention relates to a device with a safety function and a method for operating such a device.

[0007] Technical background

[0008] In a well-known motor starter, the Siemens AG ET200SP motor starter, a STO command (STO = Safe Torque Off) is sent as a DC voltage signal to a safe digital input (STO+ (24 V), STO- (GND)) ("safety function STO hardwired"). When a logic zero (= STO) is present, the ET200SP motor starter cuts off the power supply to a downstream electric motor, preventing it from generating torque or force. Conversely, a logic one (= no STO) actively enables the power supply to the electric motor. See section "6.8.2 Behavior during safety-related shutdown" on page 90 of the device manual "SIMATIC / ET 200SP / Motor starter ET 200SP (3RK1308-...)", edition 10 / 2021, publication no.

[0009] A5E34821005001A / RS-AD / 004, Publisher Siemens AG, Smart Infrastructure, Electrical Products, P.O. Box 10 09 53, 90009 Regensburg, Germany.

[0010] For SIL3, redundancy is required in the evaluation and execution of a safety function. With STO via a safety protocol, such as PROFIsafe, a hardware circuit as a redundant path is not permitted; therefore, a second controller is mandatory as a redundant path (HW = hardware). Furthermore, the standards IEC 61508-1:2010, IEC 61508-2:2010, and IEC 61508-7:2010 prescribe diagnostic procedures to manage errors. For SIL3, this includes the measure "combination of temporal and logical monitoring of program sequences," which must be applied to both controllers. Currently, it is common practice to implement this measure using an external watchdog timer for each of the two controllers.

[0011] Summary of the invention

[0012] The object of the present invention is to improve a device with a safety function. 202408803

[0013] 2

[0014] This problem is solved according to the invention by a device with the features specified in claim 1. It is a device with a safety function. The device has a bus interface for receiving and sending data packets via a bus (data bus), i.e., a system for data transmission between multiple participants via a common transmission path. The device has a technology controller configured to control the said safety function. The device has a communication controller responsible for connecting the device to the bus and configured to forward data packets created by the technology controller to the bus interface for transmission and to forward data packets received by the bus interface to the technology controller.The device has two redundant data packet evaluation paths, each configured to evaluate a data packet arriving at the device's bus interface to determine whether the data packet contains a request from the safety function. The first data packet evaluation path has the technology controller, which is configured to perform an evaluation of the data packet using a primary safety program. The second data packet evaluation path has the communication controller, which is configured to perform an evaluation of the data packet using a secondary safety program. The device also has a watchdog timer configured to perform logical and temporal program execution monitoring of the primary safety program running on the technology controller.The technology controller is configured to perform logical and temporal program run control of the second security program running on the communication controller.

[0015] This problem is further solved according to the invention by a method with the features specified in claim 7. This method is for operating a device with a safety function. The method includes receiving a data packet at a bus interface of the device. The method includes evaluating the data packet in two redundant data packet evaluation paths to determine whether it contains a request from the safety function. The evaluation of the data packet in a first of the data packet evaluation paths is performed by a first safety program running on a technology controller configured to control the safety function of the device.In this process, the data packet is evaluated in a second data packet evaluation path by a second security program running on a communication controller responsible for the device's bus connection. This controller is configured to forward data packets created by the technology controller to the bus interface for transmission and to forward data packets received from the bus interface to the technology controller. (A logical 202408803.)

[0016] 3. The timing and program execution control of the first safety program, which runs on the technology controller, is performed using a watchdog module. Logical and timing program execution control of the second safety program, which runs on the communication controller, is performed using the technology controller.

[0017] A data packet that is received or sent via a bus, also known as a data bus, can also be referred to as a "telegram" in the following.

[0018] This involves a device that receives telegrams via a bus, containing requests from one or more different safety functions, for example, in the form of a process value. These telegrams can be received cyclically by a controller. The safety functions can be certified up to SIL3.

[0019] The invention relates to an architecture for the realization of a logical and temporal program run control for a safety program on a controller using a safe bus protocol (e.g. PROFIsafe) and a second controller.

[0020] For SIL3, redundancy is required in the evaluation and execution of a safety function. Therefore, two controllers are used, which process an incoming safety function request in parallel and independently of each other. The measure prescribed by the IEC 61508 standard for SIL3, "combination of temporal and logical monitoring of program sequences," which must be applied to both controllers, is implemented for only one of the two controllers using an external watchdog timer.

[0021] Since an external watchdog module is relatively expensive and requires space on the circuit board, a way was found to implement the measure "combination of temporal and logical monitoring of program sequences" for the other of the two controllers without an external watchdog module.

[0022] Furthermore, it is possible to use a non-secure operating system on the controller, which does not have an external Watdchdog module, that calls the security program as a service.

[0023] A device with a bus connection has at least two controllers: a communication controller and a technology controller. Both controllers are responsible for the same safety function, ensuring redundancy. 202408803

[0024] 4

[0025] The communication controller forwards all telegrams created by the technology controller to the bus and forwards telegrams received from the bus to the technology controller.

[0026] There is a bus telegram that is cyclically transmitted in both directions between a program on the technology controller (e.g. PROFIsafe Device Driver) and a program (e.g. PROFIsafe Host Driver) on another device connected to the bus using a secure bus protocol (e.g. PROFIsafe).

[0027] A second safety program runs on the communication controller. This second safety program contains several safety functions that must be executed completely and in the correct order. A logical program execution control function verifies this. Only if the check returns a "Good" result does the communication controller forward the next safe bus telegram to the technology controller without alteration. Otherwise, it alters it.

[0028] It doesn't matter whether the second security program is called by a secure or insecure operating system - it just needs to be called often enough (definable watchdog time).

[0029] The first safety program on the technology controller, e.g., the PROFIsafe Device Driver, which handles communication using a secure bus protocol such as PROFIsafe, detects timeouts or other errors, such as corrupted telegrams, using this protocol and triggers the safety function in such cases. This allows the first safety program to act as a watchdog for the second safety program on the communication controller. Errors in logical program execution control are detected via corrupted telegrams. Errors in temporal program execution control, e.g., the operating system on the communication controller not calling the second safety program often enough, are detected via timeouts in the telegrams.

[0030] Logical and temporal program execution control on the technology controller is implemented using an external watchdog block. The external watchdog block has its own time base, independent of that of the technology controller. The technology controller contains logical program execution control that verifies whether all functions in the safety program are executed completely and in the correct order. Only if this is the case, within a defined time frame, is the external watchdog block triggered.

[0031] 5

[0032] The external watchdog timer is configured to trigger the safety function using an output signal if it is not triggered within the correct time window.

[0033] One advantage of the invention is that a safety function with SIL3 can be implemented via a safe bus protocol, requiring only one external watchdog timer instead of two to perform the required logical and temporal program execution control. This saves costs and board space. Furthermore, a non-safety-critical operating system can be used for the controller that is monitored by the other controller using the invention. Together, these features allow existing bus communication controllers with existing non-safety-critical operating systems to be used as a second controller for a safety function under certain circumstances, without requiring relatively extensive hardware or firmware modifications for logical and temporal program execution control.

[0034] Embodiments of the invention

[0035] Advantageous embodiments and further developments of the invention are specified in the dependent claims. The method according to the invention can also be further developed according to the dependent apparatus claims, and vice versa.

[0036] According to a preferred embodiment of the invention, the watchdog module is configured to perform logical and temporal program execution control of the first safety program running on the technology controller in conjunction with a first firmware program module, and the technology controller is configured to perform logical and temporal program execution control of the second safety program running on the communication controller in conjunction with a second firmware program module (FW = Firmware). The logical and temporal program execution control of the first safety program on the technology controller is implemented using the external watchdog module in conjunction with a first firmware program module. The second firmware program module on the technology controller contains a logical program execution control that verifies whether all functions in the safety program are executed completely and in the correct sequence.Only if this is the case will the external watchdog timer be triggered within a defined time window. The external watchdog timer is configured to trigger the safety function using an output signal if it is not triggered within the correct time window. 202408803.

[0037] 6

[0038] According to a preferred embodiment of the invention, the device is a motor starter configured for a fixed-speed motor, and the safety function is a switching function for interrupting a load current path passing through the motor starter. The device can be a motor starter that receives a request for the safety function "STO" (Safe Torque Off) from a fail-safe PLC. This request can be sent as a process value of a data packet to a bus interface of the motor starter. Providing the ability to receive an STO command via a bus protocol at a motor starter requires less wiring effort than signaling an STO command to the motor starter via a safe voltage input.

[0039] According to a preferred embodiment of the invention, the data packet is secured using a safe bus protocol, e.g., PROFIsafe. The advantage is that using a safe bus protocol eliminates the need for a component, such as a safety switching device or a safe digital output module, since a safety controller can transmit the STO signal directly to the motor starter via a bus. Using a safe bus protocol, which must also be certified according to SIL3, ensures that communication errors (= transmission errors) are detected and that STO is initiated in such cases.

[0040] According to a preferred embodiment of the invention, for the evaluation of an STO command received via the bus interface, a program runs on the technology controller. This program uses a safe bus protocol, also referred to as a "safety protocol," to detect communication errors in the cyclic exchange of telegrams containing the process value for STO and to extract the process value for STO. The safety protocol can be, for example, PROFIsafe. STO is triggered by the technology controller when the corresponding cyclic process value reaches the value defined for triggering STO, or when a relevant communication error is detected during the transmission of the telegrams containing this process value using the safe bus protocol, e.g., PROFIsafe. Such a communication error can be a transmission error. Safety protocols detect errors that can occur during bus communication, e.g.,Timeouts, incorrect addressing, lost telegrams, data corruption. Various security measures can be used for this; these can be, for example, CRC checksums, telegram numbers, or similar, which are appended to the actual payload in the transmitted telegrams, containing the STO instruction, e.g., in the form of an STO / No_STO bit. The "Safety Protocol Program" preferably outputs the following two outputs: 202408803.

[0041] 7

[0042] - a value of the STO / NOT_STO bit; and

[0043] - Information on whether the value of the STO / NOT_STO bit is valid (e.g., if neither a communication error that was not corrected within the timeout period nor a timeout has occurred) or invalid (e.g., if a communication error that was not corrected within the timeout period or a timeout has occurred). An advantage of this is that it reliably detects whether an STO signal sent to the motor starter via the bus is valid or whether its value cannot be reliably determined due to communication errors.

[0044] According to a preferred embodiment of the invention, in the event of a data packet transmission error, STO (Safe Torque Off) is triggered if the transmission error is not rectified within a specified time period by a correct retransmission of the data packet. This is one of the reasons why a safe bus protocol is used. With regard to a safe protocol for safeguarding the data packets, e.g., telegrams, safeguarding does not mean that the data packets are protected against transmission errors, but only that such transmission errors are reliably detected. An advantage of this is that no dangerous situation can arise due to undetected communication errors that would cause an STO signal sent via the bus to the motor starter to be misinterpreted as such.

[0045] According to a preferred embodiment of the invention, the device has a signal path that leads from the communication controller to the technology controller, wherein the two data packet evaluation paths are configured such that a data packet arriving at the bus interface is routed to the technology controller via the signal path. An advantage of this is that it allows for evaluation in two redundant data packet evaluation paths to determine whether the safety function is requested via the data packet: once by a first safety program on the technology controller and once by a second safety program on the communication controller.

[0046] According to a preferred embodiment of the invention, the signal path includes a normally open (NO) switch, and the communication controller has a logical program execution control that switches the NO switch to a conducting state when a data packet arriving at the communication controller completely and in a predetermined sequence passes through several security checks of the second security program running on the communication controller (NO = Normally Open). An advantage of this is that the security program on the technology controller detects missing telegrams and...

[0047] 8 thereby taking over the watchdog function for the communication controller and triggering the safety function in the event of a detected malfunction of the communication controller.

[0048] According to a preferred embodiment of the invention, the logical and temporal program execution control of the first safety program, which runs on the technology controller, is performed using the watchdog module in conjunction with a first firmware module, and the logical and temporal program execution control of the second safety program, which runs on the communication controller, is performed by a second firmware module of the technology controller. The logical and temporal program execution control of the first safety program on the technology controller is implemented using the external watchdog module in conjunction with a first firmware module. The second firmware module on the technology controller contains a logical program execution control that verifies whether all functions in the safety program are executed completely and in the correct sequence.Only if this is the case will the external watchdog timer be triggered within a defined time window. The external watchdog timer is configured to trigger the safety function using an output signal if it is not triggered within the correct time window.

[0049] According to a preferred embodiment of the invention, in the proper operation of the communication controller, a data packet arriving at the communication controller undergoes several security checks of the second security program running on the communication controller completely and in a predetermined sequence, wherein a function for logical program execution control running on the communication controller allows an incoming data packet to pass to the technology controller unaltered only if the data packet passes the said security checks properly, and otherwise forwards the data packet to the technology controller in an altered state, and wherein the technology controller performs the logical and temporal program execution control of the communication controller by triggering a security function upon receiving a corrupted or delayed data packet.One advantage is that no external watchdog module is needed for the logical and temporal program execution control of the communication controller, as the existing technology controller is used for this purpose. This saves space and costs.

[0050] According to a preferred embodiment of the invention, a data packet is delayed at the technology controller if an operating system on the communication controller does not call the second safety program often enough. An advantage of this is that the technology controller... 202408803

[0051] 9

[0052] The controller can thus detect when the second security program on the communication controller is not called frequently enough and can therefore take over the timing of program execution without requiring an additional external watchdog module.

[0053] According to a preferred embodiment of the invention, the safety function is a STO function. An advantage of this is that it is a common safety function in drive technology, where the safety function is requested via an interface, e.g., a bus, and the safety function is then executed.

[0054] Exemplary embodiments of the drawing

[0055] The properties, features, and advantages of this invention described above, as well as the manner in which they are achieved, will become clearer and more easily understood through the following description of exemplary embodiments, which will be explained in more detail with reference to the drawings. The drawings are schematic and not to scale.

[0056] Fig. 1 shows a motor branch; and

[0057] Fig. 2 shows a motor starter according to the invention in a first embodiment;

[0058] Fig. 3 shows a flowchart of the procedure for operating a motor starter; and

[0059] Fig. 4 shows a motor starter according to the invention in a different embodiment.

[0060] Detailed description of the exemplary implementations

[0061] Fig. 1 shows a motor branch. From a power supply network 40 with three phase conductors L1, L2, L3, e.g., a three-phase network, a three-phase load circuit 41 branches off at connection points 42, via which electrical energy can be transported to an electric motor 43. The motor can be a low-voltage three-phase asynchronous motor or any other electrically operated motor.

[0062] A motor starter 50, acting as a safety device, is connected between connection points 42 and the motor 43 in the phase conductors L1, L2, L3 of the load circuit 41. The motor starter has input terminals 31 on the mains side and output terminals 32 on the load side, to which the phase conductors L1, L2, L3 are connected. Inside the motor starter 50, between the input terminals 31 and the output terminals 32, the following lines run: 202408803

[0063] 10

[0064] Load current paths that can be interrupted using switching devices of the motor start 50.

[0065] The motor starter 50 switches all three phase conductors L1, L2, L3 of the load circuit 41. For this purpose, the motor starter 50, which can be divided into a power section and a control section, has at least one switch per phase L1, L2, L3 in its power section. The switch can be electromechanical, e.g., a relay, or electronic, e.g., a transistor (MOSFET, IGBT, etc.). It is also possible that at least one electromechanical switch, e.g., a relay or a galvanically isolating disconnect switch, and one electronic semiconductor switch, e.g., a transistor switch, are arranged in series in at least one phase conductor. The motor starter is configured for a fixed-speed motor.

[0066] The motor starter 50 has a bus interface 3 and a voltage input 4. The bus interface 3 is used to receive and send data packets via a bus line 10B. The voltage input 4 is connected to an electrical line 10U; in this way, a voltage is applied to the voltage input 4, the voltage level of which can signal the motor starter.

[0067] A command, such as an STO signal, can be transmitted to the motor starter 50 via both bus interface 3 and voltage input 4. Other devices are also connected to bus line 10B: a bus node 62 in the form of a PLC, which sends commands such as an STO signal to the motor starter 50, and a parameterization device 61 (PLC = Programmable Logic Controller). The parameterization device 61, e.g., a PC (Personal Computer) with an engineering tool such as the Siemens TIA Portal (TIA = Totally Integrated Automation), does not send parameterization data directly to the motor starter 50, but rather to the PLC 62. The parameterization data is permanently stored there, and the PLC 62 sends the parameterization data to the motor starter 50 whenever the motor starter 50 "reports" to bus 10B after starting up."Start-up" of the motor starter 50 means that the motor starter 50 is switched on by connecting a 24 V supply voltage to its control unit. The parameterization device 61 is therefore only required for initial parameterization and if the parameterization data is to be changed after the initial parameterization.

[0068] An STO release device 65, e.g. a light barrier, a light curtain, a safety mat, an emergency stop switch, a safety door or a safety scanner, can be connected to the electrical line 10U, which is connected to the voltage input 4, e.g. a light barrier, a light curtain, a safety mat, an emergency stop switch, a safety door or a safety scanner, 202408803

[0069] 11. When a defined condition is present, a safety command in the form of an STO signal is sent to the motor starter 50: the safety command can be signaled to the motor starter 50 by a defined voltage level, e.g. a voltage < 5 V, at the voltage input 4.

[0070] Fig. 2 shows a first embodiment of a device according to the invention. The device comprises a technology controller 1, a communication controller 2, and a watchdog timer 17. The watchdog timer 17 can be integrated into a microcontroller or implemented as a microelectronic component mounted on a circuit board. The technology controller 1 has a first safety program 15. The communication controller 2 has a second safety program 75. The watchdog timer 17 is configured to perform logical and temporal program execution monitoring of the first safety program 75, which runs on the technology controller 1. The technology controller 1 is configured to perform logical and temporal program execution monitoring of the second safety program 75, which runs on the communication controller 2.

[0071] Fig. 3 shows a flowchart of the procedure for operating a device as shown in Fig. 2. In a first step 201, a data packet is received at a bus interface of the device. In two parallel steps, the second step 202 and the third step 203, the data packet is evaluated in two redundant data packet evaluation paths to determine whether it contains a request from the safety function. In the second step 202, the data packet is evaluated in the first of the data packet evaluation paths by a first safety program running on a technology controller configured to control the device's safety function.In the third step 203, the data packet is evaluated in a second data packet evaluation path of the data packet evaluation paths by a second security program, which runs on a communication controller that is responsible for a bus connection of the device and is configured to forward data packets created by the technology controller to the bus interface for sending and to forward data packets received from the bus interface to the technology controller.

[0072] Logical and temporal program execution control 204 of the first safety program, which runs on the technology controller, is performed using a watchdog module. Logical and temporal program execution control 205 of the second safety program, which runs on the communication controller, is performed using the technology controller. 202408803

[0073] 12

[0074] In a fourth step 206, a decision is made: If the data packet does not contain a request for a safety function and no errors have been detected by the logical and temporal program run control 204 or 205, the procedure 207 returns to the first step 201. If the data packet contains a request for a safety function, e.g., STO 208, the safety function is executed 209, e.g., an interruption of the load current path is triggered.

[0075] Fig. 4 shows a further embodiment of a device according to the invention, which is a motor starter 50. The motor starter 50 has a load current path 9 running through the motor starter 50, which runs from an input 31 of the load current line (mains / power supply side) to an output 32 of the load current line (load side), for conducting a load current.

[0076] The motor starter 50 has a bus interface 3 for receiving incoming data packets 101 and for sending outgoing data packets 112 via a bus line 10B; thus, a request for a safety function, e.g., an STO signal, can be signaled to the motor starter 50 by an incoming bus data packet 101.

[0077] The motor starter 50 has a switching device 7, 8 for interrupting the load current path 9. The switching device 7, 8 can perform a switching action electromechanically, with an actuator 7 and a relay 8. Alternatively, the switching device 7, 8 can perform a switching action electronically, with a control unit 7, e.g., a gate driver, and a semiconductor switch 8, e.g., a transistor. The device 50 has a technology controller 1, a communication controller 2, and a watchdog timer 17. The technology controller 1 is configured to control the aforementioned safety function. The communication controller 70 is responsible for a bus connection of the device 50 and is configured to forward data packets 112 created by the technology controller 1 for transmission to the bus interface 3 and to forward data packets 101 received by the bus interface 3 to the technology controller 1.The watchdog component 17 can be integrated into a microcontroller or implemented by a microelectronic component mounted on a circuit board.

[0078] A first safety program 15 is running on the technology controller 1. A second safety program 75 is running on the communication controller 2. The watchdog block 17 is configured, in conjunction with a first firewall program block, to perform a logical and temporal program execution check 14 of the first safety program 15 running on the technology controller 1. The external watchdog block 17 has a 202408803

[0079] 13. The external watchdog block 17 has its own time base, independent of that of the technology controller 1. The FW program block on the technology controller 1 contains a logical program execution control 14, which checks whether all functions in the safety program are executed completely and in the correct order. Only if this is the case is the external watchdog block 17 triggered within a defined time window by a signal 125 sent from the technology controller 1 to the watchdog block 17. The external watchdog block 17 is configured to trigger the safety function using an output signal 107 if it is not triggered within the correct time window.

[0080] The technology controller 1 is configured to perform logical and temporal program run control of the second safety program 75, which runs on the communication controller 2.

[0081] The motor starter 50 has two independent, redundant data packet evaluation paths, each configured to evaluate a data packet 101 arriving at the bus interface 3 of the device 50 to determine whether the data packet 101 contains a request for the safety function. The first data packet evaluation path includes the technology controller 1, which is configured to evaluate the data packet 101 using the first safety program 15. The second data packet evaluation path includes the communication controller 2, which is configured to evaluate the data packet 101 using the second safety program 75.

[0082] The communication controller 2 is connected to the interface 3 via a first signal path 120. Data packets 101 received at the interface 3 are forwarded via the first signal path 120 to a service unit 73 of the communication controller 1 and via a first communication node 130 of the first signal path 120 to a second signal path 121. Data packets 112 outgoing from the technology controller 1 are forwarded via a third signal path 122, a second communication node 131, and a fourth signal path 123 to the interface 3. The service unit 73 of the communication controller 1 has the second safety program 75 and a function 74 for logical program execution control 74. The communication controller 2 evaluates a data packet 101 received at the interface 3 for a request for a safety function, e.g., an STO signal.

[0083] The second security program 75 contains several security functions 751, 752, 753, which are fully and in the correct order executed by an incoming data packet 101 202408803

[0084] 14 must be traversed; the function 74 integrated into the communication controller 2 for logical program execution control verifies this. If this check shows that the safety functions 751, 752, 753 are traversed completely and in the correct order, the communication controller 2 forwards the next data packet 101 unaltered to the technology controller 1 by setting a normally open (NO) switch 80 located in a second signal path 121 to a conducting state, so that the next data packet 101, which is transported via the first signal path 120 and is branched off at a first communication node 130 onto the second signal path 121, can pass the NO switch 80 and reach the technology controller 1 via the second signal path 121.If, however, this check reveals that the security functions 751, 752, 753 are not executed completely and / or not in the correct order, the communication controller 2 corrupts the next data packet 101. It is irrelevant whether the second security program 75 is called by a secure or a non-secure operating system 72; it only needs to be called often enough (fixed / configurable watchdog time).

[0085] A safety protocol program 11 on the technology controller, e.g., the PROFIsafe Device driver, operating on the basis of a secure bus protocol, detects timeouts or other errors, such as corrupted telegrams, using the secure bus protocol and triggers the safety function in this case. This allows it to take over the watchdog function for the second safety program 75 on the communication controller 2. Errors in the logical program execution control 74 are detected via corrupted telegrams. Errors in the temporal program execution control, e.g., the operating system 72 on the communication controller 2 does not call the safety program 75 often enough, are detected via timeouts in the telegrams.

[0086] If the safety program 15 of the technology controller 1 detects a request for a safety function after evaluating the data packet 101, it sends a first trigger signal 105 to an OR gate 16 of the motor starter 50. The OR gate 16 can be a logic gate or an electronic circuit that performs the function of a logic gate.

[0087] If the safety program 75 of the communication controller 1 detects an error during the execution of safety functions 751, 752, 753, or a request from the safety function during the evaluation of data packet 101, it sends a second trigger signal 106 to the OR gate 16. 202408803

[0088] 15

[0089] If the watchdog module 17 detects an error during the logical and temporal program run control 14 of the technology controller 1, it sends a third trigger signal 107 to the OR gate 16. As soon as a trigger signal 105, 106, 107 is present at the OR gate 16, a switching signal 111 is sent from the OR gate 16 to the switching device 7, 8 in order to open the switch 8 without delay.

[0090] The load current path 9 can have one or more phases. For each phase, the motor starter 50 has a phase-specific part which includes a switching device 7, 8.

[0091] Furthermore, the motor starter 50 has a common part that is common to all phases: this includes the interface 3, the technology controller 1, the OR gate 16 and the communication controller 2.

[0092] 202408803

[0093] 16

[0094] Reference symbol list

[0095] 1 Technology Controller

[0096] 2 communication controllers

[0097] 3 Bus interface

[0098] 7 Actuator, control unit

[0099] 8 switches

[0100] 9. Power line

[0101] 10B Bus line

[0102] II Safety Protocol Program of 1

[0103] 14 Program run control

[0104] 15 Security program, first of 1

[0105] 16 Oder gates

[0106] 17 Watchdog component, external

[0107] 31 Input of the load current line (power supply side, network side)

[0108] 32 Output of the load current line (load side)

[0109] 40 Power supply network

[0110] 41 Motor supply line

[0111] 43 Engine

[0112] 50 engine starters

[0113] 61 Parameterization device

[0114] 62 bus nodes, F-PLC

[0115] 65 STO release device

[0116] 72 Operating system

[0117] 73 Service Unit

[0118] 74 Function for logical program run control

[0119] 75 Security program, second of 2

[0120] 80 switches, NO-

[0121] 101 Bus data packet, incoming

[0122] 105 Trigger signal, first

[0123] 106 Trigger signal, second

[0124] 107 Trigger signal, third

[0125] III Switching signal

[0126] 112 Bus data packet, outgoing

[0127] 120 signal path, first

[0128] 121 Signal path, second 202408803

[0129] 17

[0130] 122 Signal path, third

[0131] 123 Signal path, fourth

[0132] 125 Signal path, fifth

[0133] 130 communication nodes, first; 131 communication nodes, second

[0134] 201-209 Procedural steps

[0135] 751 Safety function 1

[0136] 752 Safety function 2

[0137] 753 Safety function x

Claims

202408803 18 Patent claims 1. Device (50) with a safety function, wherein the device (50) has: - a bus interface (3) for receiving and sending data packets (101, 112) via a bus (10B), - a technology controller (1) configured to control said safety function, - a communication controller (2), which is responsible for a bus connection of the device (50) and is configured to forward data packets (112) created by the technology controller (1) to the bus interface (3) for transmission and to forward data packets (101) received from the bus interface (3) to the technology controller (1), - two redundant data packet evaluation paths, each configured to evaluate a data packet (101) arriving at the bus interface (3) to determine whether the data packet (101) contains a request for the safety function, wherein a first data packet evaluation path includes the technology controller (1) configured to perform an evaluation of the data packet (101) using a first safety program (15), and wherein a second data packet evaluation path includes the communication controller (2) configured to perform an evaluation of the data packet (101) using a second safety program (75), and - a watchdog block (17) configured to perform logical and temporal program execution control (14) of the first safety program (15) running on the technology controller (1), wherein the technology controller (1) is configured to perform logical and temporal program execution control of the second safety program (75) running on the communication controller (2).

2. Device according to claim 1, - wherein the watchdog block (17) is configured to perform the logical and temporal program execution control (14) of the first safety program (15) in conjunction with a first firewall program block, and - wherein the technology controller (1) is configured to perform the logical and temporal program run control of the second safety program (75) with a second FW program block.

3. Device according to one of the preceding claims, 202408803 19 wherein the device (50) is a motor starter configured for a fixed speed motor (43) and the safety function is a switching function to interrupt a load current path (9) passing through the motor starter (50).

4. Device according to any of the preceding claims, wherein the data packet (101) is secured using a secure bus protocol.

5. Device according to one of the preceding claims, comprising a signal path (120, 121) which leads via the communication controller (2) to the technology controller (1), wherein the two data packet evaluation paths are configured such that a data packet (101) arriving at the bus interface (3) is routed via the signal path (120, 121) to the technology controller (1).

6. Device according to claim 5, wherein the signal path (121) has a NO switch (80) and the communication controller (2) has a logical program run control (74) which switches the NO switch (80) to a conducting state when a data packet (101) arriving at the communication controller (2) completes several safety checks (751, 752, 753) of the safety program (75) running on the communication controller (2) in a predetermined sequence.

7. Method for operating a device (50) with a safety function, comprising the following steps: - Receiving a data packet (101) at a bus interface (3) of the device (50); - Evaluating in two redundant data packet evaluation paths whether the data packet (101) contains a request of the safety function, wherein an evaluation of the data packet (101) in a first of the data packet evaluation paths is carried out by a first safety program (15) which runs on a technology controller (1) which is configured to control the safety function of the device (50), wherein an evaluation of the data packet (101) in a second of the data packet evaluation paths is carried out by a second safety program (75) which runs on a communication controller (2) which is responsible for a bus connection of the device (50) and is configured to forward data packets (112) created by the technology controller (1) for transmission to the bus interface (3) and to forward data packets (101) received by the bus interface (3) to the technology controller (1), 202408803 20 - wherein logical and temporal program execution control of the first security program (15) running on the technology controller (1) is carried out using a watchdog module (17), - wherein logical and temporal program run control of the second safety program (75), which runs on the communication controller (2), is carried out by the technology controller (1).

8. Method according to claim 7, wherein the logical and temporal program execution control of the first safety program (15) is carried out using the watchdog module (17) in conjunction with a first FW program module, and - wherein the logical and temporal program run control of the second safety program (75) is carried out by a second FW program module of the technology controller (1).

9. Method according to one of claims 7 or 8, - wherein, in the proper operation of the communication controller (2), a data packet (101) arriving at the communication controller (2) undergoes several security checks (751, 752, 753) of the second security program (75) running on the communication controller (2) completely and in a predetermined order, - wherein a function (74) for logical program execution control, running on the communication controller (2), allows an incoming data packet (101) to pass to the technology controller (1) unaltered only if the data packet (101) passes the said security checks (751, 752, 753) correctly, and otherwise forwards the data packet (101) to the technology controller (1) in an altered state, - wherein the technology controller (1) performs the logical and temporal program execution control of the communication controller (2) by triggering a safety function upon receiving a corrupted or delayed data packet (101).

10. Method according to claim 9, wherein a data packet (101) at the technology controller is delayed if an operating system (72) on the communication controller (2) does not call the second safety program (75) often enough.

11. Method according to any one of claims 7 to 10, 202408803 21 where the safety function is an STO function.

Images